Zyxel ZLD Firewalls CVE-2026-14818

Exploitation requires a valid administrator-level account on the affected Zyxel device, confirmed by CVSS PR:H - standard operator or read-only accounts cannot invoke the configuration file execution CLI command in a manner that triggers this flaw. The specific trigger is use of the CLI configuration file execution command with a path argument that is not adequately sanitized, allowing directory traversal outside the intended configuration directory. The device must be running one of the affected firmware versions: ATP V4.32-V5.42 Patch 1, USG FLEX V4.50-V5.42 Patch 1, USG FLEX 50(W) V4.16-V5.42 Patch 1, or USG20(W)-VPN V4.16-V5.42 Patch 1. Limiting factors: administrator-level authentication is a hard prerequisite; management interfaces (SSH/HTTPS) are typically network-restricted to trusted management segments, further narrowing real-world exposure; no user interaction is required once admin access is present. Non-default configuration is not required - any device in the affected firmware range with an accessible management interface is potentially vulnerable given admin credentials.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) scores 7.2, reflecting the tension between high potential impact and a meaningful authentication prerequisite. PR:H is the decisive limiting factor: successful exploitation requires valid administrator-level credentials, meaning this vulnerability cannot be leveraged by an unauthenticated external attacker without first compromising an admin account. The AV:N vector confirms the CLI is reachable over a network (SSH, HTTPS management interface), but firewall management interfaces are typically not exposed to the internet - most deployments restrict these to dedicated management VLANs or jump hosts. No EPSS data is provided; however, the absence of a KEV listing and no known public POC suggests this is not currently being exploited at scale. The highest realistic risk scenario is insider threat or credential reuse following a phishing campaign. The S:U (scope unchanged) metric correctly reflects that impact is contained to the compromised appliance. Overall, this is a genuine high-severity issue for affected organizations but does not meet the threshold of an urgent emergency patch outside of high-risk environments without compensating controls on management access.

An attacker who has obtained valid Zyxel administrator credentials - through phishing, credential stuffing, or insider access - connects to the device CLI remotely over SSH or the HTTPS management interface. The attacker issues the configuration file execution CLI command with a crafted path containing traversal sequences (e.g., ../../) to reference a malicious file placed or controlled outside the intended configuration directory, causing the ZLD firmware to parse and execute it with elevated privileges. No public proof-of-concept is known at time of analysis, but the path traversal primitive is a well-understood exploitation class requiring minimal specialized knowledge once admin access is established.